216.73.217.22

HoldingHands

AlienVault · Published 20/12/2025 20:01 · Modified 21/12/2025 18:48

Essential information

Confidence
100/100
Is family
No
Published
20/12/2025 20:01
Modified
21/12/2025 18:48
Revoked
No
Author / Source
AlienVault
Related entities
37 attack patterns (mitre), 1 intrusion sets (apt), 2 sectors, 12 countries, 45 indicators, 1 reports

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators, intrusion sets and other entities linked to this malware.

Attack patterns (MITRE) (37)

  • T1566.001 uses
    Spearphishing Attachment
  • T1134 uses
    Access Token Manipulation
  • T1059 uses
    Command and Scripting Interpreter
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1036 uses
    Masquerading
  • T1573.001 uses
    Symmetric Cryptography
  • T1056.001 uses
    Keylogging
  • T1566 uses
    Phishing
  • T1204.002 uses
    Malicious File
  • T1112 uses
    Modify Registry
  • T1071 uses
    Application Layer Protocol
  • T1005 uses
    Data from Local System
  • T1083 uses
    File and Directory Discovery
  • T1566.003 uses
    Spearphishing via Service
  • T1204.001 uses
    Malicious Link
  • T1055.001 uses
    Dynamic-link Library Injection
  • T1082 uses
    System Information Discovery
  • T1113 uses
    Screen Capture
  • T1204 uses
    User Execution
  • T1041 uses
    Exfiltration Over C2 Channel
  • T1125 uses
    Video Capture
  • T1016 uses
    System Network Configuration Discovery
  • T1574 uses
    Hijack Execution Flow
  • T1055.003 uses
    Thread Execution Hijacking
  • T1055.012 uses
    Process Hollowing
  • T1012 uses
    Query Registry
  • T1055 uses
    Process Injection
  • T1119 uses
    Automated Collection
  • T1497 uses
    Virtualization/Sandbox Evasion
  • T1027 uses
    Obfuscated Files or Information
  • T1598 uses
    Phishing for Information
  • T1053 uses
    Scheduled Task/Job
  • T1057 uses
    Process Discovery
  • T1574.002 uses
  • T1105 uses
    Ingress Tool Transfer
  • T1566.002 uses
    Spearphishing Link
  • T1571 uses
    Non-Standard Port

Intrusion sets (APT) (1)

  • TA4922 uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 04/06/2026 10:38 · Modified 04/06/2026 10:38

Sectors (2)

  • Government targets
  • Finance targets

Countries (12)

  • India targets
  • Italy targets
  • Singapore targets
  • United Kingdom of Great Britain and Northern Ireland targets
  • Japan targets
  • Taiwan targets
  • South Africa targets
  • Malaysia targets
  • Germany targets
  • British Indian Ocean Territory targets
  • Indonesia targets
  • China targets

Indicators (45)

Reports (1)